A large number of merchants maintain an online presence through the use of the Internet and the World Wide Web. In fact, some merchants maintain no physical stores at all. Instead, these merchants conduct all of their transactions over the Internet. Merchants engaging in electronic commerce are sometimes referred to as e-commerce merchants or online merchants. E-commerce merchants face many challenges compared to physical merchants.
Transactions conducted at a physical store may use payment instruments that also have a physical manifestation. For example, cash and personal checks are common physical payment instruments. Even when transaction accounts, such as credit or debit accounts, are used, the purchaser will typically be in possession of a physical token representing the account. A token, such as a credit card, can be examined by a merchant to confirm that the purchaser is in possession of the token and, to some extent, confirm the purchaser is authorized to use the token. For example, a merchant may examine the signature panel on the rear of a transaction card and compare it with a signature of the person using the transaction card. A match can be an indication that the user is authorized to use the card.
The use of physical payment instruments, such as cash and checks, in an e-commerce environment is typically not practical. As such, the use of transaction accounts in e-commerce is very common. Unfortunately, the use of transaction accounts has also lead to an increase in the potential for fraudulent use. The techniques used by a physical merchant to prevent fraud, such as verifying that the purchaser is in possession of the token and that signatures match, are typically not available in an e-commerce environment. An online merchant is typically able to obtain the transaction account number, the expiration date, and potentially additional token identifying information (e.g. cardholder verification value—the 3 digit number in the signature panel of most transaction cards) from the user during a checkout process on the e-commerce site. However, the merchant has no way of verifying that the user is actually in possession of the transaction card. Furthermore, even if the user is in possession of the transaction card, the merchant is not able to verify that the purchaser is authorized to use the transaction card.
Electronic commerce card associations and issuers have also instituted authentication systems to ensure that electronic commerce cards are only used by authorized cardholders. One example of an authentication system enables a cardholder to associate a password or other identifying information with an electronic commerce card. To make a purchase online, the consumer must provide the password, or other identifying information, associated with the electronic commerce card. This ensures that the person possessing the electronic commerce card is actually authorized to use the electronic commerce card.
While such authentication methods are effective, a number of improvements can be made. Better ways to authenticate consumers are desirable. Embodiments of the invention address the above problems, and other problems, individually and collectively.